Classificação de dados baseada em redes complexas para detecção de binários empacotados

Abstract

The information security field is constantly being tested with new vulnerabilities and challenges to fix them, an example is packed binaries that are malicious executables obfuscated in the process of compressing a file. However, antivirus systems find it difficult to detect the package as dangerous, due to the hiding technique present in the file. Data classification, which is a branch of machine learning, takes several approaches when analyzing physical data, which can limit performance. Complex networks in machine learning are structures that do not follow a regular or random pattern. Due to its versatility, its use for data classification has become increasingly relevant, due to successful results when analyzing its measures and properties for labeling an instance. The construction of a network interconnects data, through their common characteristics, with this it is possible to interpret structural and topological patterns. In view of this scenario, this work proposes the construction of a network based on k-nearest neighbors and the learning of network patterns via pattern compliance through six network measures selected in the literature: assortativity, clustering coefficient, average degree, betweenness, shortest mean path and closeness. The results point to an average accuracy of more than ninety percent, in addition to a better result in the seven packagers analyzed in relation to different classifiers in the literature, validating the generated network and helping the detection of packed files.